Netgate SG-1000 microFirewall

Author Topic: Block Block None & categories & anonymizers  (Read 100 times)

0 Members and 1 Guest are viewing this topic.

Offline MR-NT

  • Newbie
  • *
  • Posts: 23
  • Karma: +0/-1
    • View Profile
Block Block None & categories & anonymizers
« on: February 06, 2018, 01:44:07 pm »
Dear All

how Can i Block Block None categories website &  & anonymizers  , by any way Squid , Squidguard , Snort .......

Many thanks in adavnce

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 15193
  • Karma: +1414/-206
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Block Block None & categories & anonymizers
« Reply #1 on: February 06, 2018, 02:03:18 pm »
Give an example what what site are you trying to block - you mean a site that does not fall into a category on squidguard?  That might be hard since squidguard is all about blacklist and not trying categories every site into different stuff that you would allow like major players you pay for, forcepoint (websense), bluecoat, zscaler, etc.

The commercial content filtering products you can pick like allow shopping or drugs, or whatever - its not really based on blocking where squidguard is more about just picking the stuff that you want to block and evreything else is allowed.  You could go with a whitelist approach... But that is very difficult to manage as well unless the list is small.

If you need the ability to basically categories the internet and only allow the sites that have been put into a category your going to have to pay for a commercial product where they make their bread and butter categorizing the web.  And when you run into a site that is not in some category you fill out a online for or email them and then they place that site into a category or take your suggestion on what category it should be in etc..

With such products your not so much paying for the proxy functionality but the categorizing of the internet so you can filter what sort of content your users can access...  If your not in a corp setup with $$$ for a budget then your not going to to be able to do such a thing..
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.2-RELEASE-p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline MR-NT

  • Newbie
  • *
  • Posts: 23
  • Karma: +0/-1
    • View Profile
Re: Block Block None & categories & anonymizers
« Reply #2 on: February 06, 2018, 02:09:53 pm »
all what  iam trying to do is blocking Application called psiphon ,  which is connected to random sites , i track ir with wireshrak & block it by collect all subnets thet are talking to but i want professional methos by snort or squidguard , i used snort & i got the application trying to connect over openssh , ssh http , https  check attached files

Can you help me with this issue , or how can i take the application signature exactly & BLOCK IT

Many thanks in advance

Offline NogBadTheBad

  • Sr. Member
  • ****
  • Posts: 502
  • Karma: +45/-0
    • View Profile
Re: Block Block None & categories & anonymizers
« Reply #3 on: February 06, 2018, 02:34:35 pm »
Why do you keep posting the same question in multiple sections.

https://forum.pfsense.org/index.php?topic=143715.0

https://psiphon.ca/en/faq.html#port-restrictions

It uses the following ports by the look of things, they've chosen these ports for a reason the red ones specifically will cause you issues if you block them.

53, 80, 443, 465, 587, 993, 995, 8000, 8001, 8080


Offline johnpoz

  • Hero Member
  • *****
  • Posts: 15193
  • Karma: +1414/-206
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Block Block None & categories & anonymizers
« Reply #4 on: February 06, 2018, 02:37:28 pm »
Yeah that is going to be tuff - your going to have to use ssl inspection to block that... Its a nasty way to circumvent content filtering..

Or your just going to have to find a list of IPs and block those.. You can do it wack a mole method and just watch your logs and shutdown all the IPs you can see that are clearly what you do not want like.. That app can run on some odd ports, and 80 which makes it difficult to filter..
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.2-RELEASE-p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline MR-NT

  • Newbie
  • *
  • Posts: 23
  • Karma: +0/-1
    • View Profile
Re: Block Block None & categories & anonymizers
« Reply #5 on: February 06, 2018, 02:44:06 pm »
Why do you keep posting the same question in multiple sections.

https://forum.pfsense.org/index.php?topic=143715.0

https://psiphon.ca/en/faq.html#port-restrictions

It uses the following ports by the look of things, they've chosen these ports for a reason the red ones specifically will cause you issues if you block them.

53, 80, 443, 465, 587, 993, 995, 8000, 8001, 8080

I am sorry For that